#!/usr/bin/python3

import glob
import re
import json
from pyattck import Attck

intellist = {}

for filename in glob.glob("intel/*.json"):
    tacticlist = []
    filedata = re.match(".*\/LM([0-9]+).json", filename)
    if filedata:
        issueid = filedata.groups(0)[0]
        file = open(filename, "r")
        intel = json.load(file)
        currentflag = not intel["closed"]
        for label in intel["labels"]:
            if label["name"] == "deprecated" or label["name"] == "duplicate" or label["name"] == "documentation" or label["name"] == "bug" or label["name"] == "invalid":
                currentflag = currentflag and False
        if currentflag:
            inteltitle = re.sub("\[Intel\]: ", "", intel["title"])
            for line in intel["body"].splitlines():
                matchdata = re.match("^### (.*)", line)
                if matchdata:
                    generatorstate = matchdata.groups(0)[0]
                else:
                    if line != "" and line != "_No response_":
                        if generatorstate == "Parent threat":
                            for tacticname in line.split(", "):
                                tacticlist.append(tacticname)
                techniquedata = re.match("attack:(T[0-9.]+)", line)
                if techniquedata:
                    for techniqueid in techniquedata.groups(0):
                        if techniqueid not in intellist:
                            intellist[techniqueid] = {}
                        if inteltitle not in intellist[techniqueid]:
                            intellist[techniqueid][inteltitle] = {}
                        if "tactics" not in intellist[techniqueid][inteltitle]:
                            intellist[techniqueid][inteltitle]["tactics"] = tacticlist
                        if "issues" not in intellist[techniqueid][inteltitle]:
                            intellist[techniqueid][inteltitle]["issues"] = []
                        intellist[techniqueid][inteltitle]["issues"].append(issueid)
                        if "Malware reports" in intel["body"]:
                            if techniqueid not in intellist:
                                intellist[techniqueid] = {}
                            if inteltitle not in intellist[techniqueid]:
                                intellist[techniqueid][inteltitle] = {}
                            intellist[techniqueid][inteltitle]["citable"] = True
                        else:
                            intellist[techniqueid][inteltitle]["citable"] = False

attack = Attck()
for tactic in attack.enterprise.tactics:
    print("## %s" % tactic.name)
    print()
    for technique in tactic.techniques:
        if technique.technique_id in intellist:
            print("%s: %s"  % (technique.technique_id, technique.name))
            if "Linux" not in technique.x_mitre_platforms:
                print()
                print("missing from ATT&CK")
            print()
            for articleurl in intellist[technique.technique_id]:
                if tactic.name in intellist[technique.technique_id][articleurl]["tactics"]:
                    for intelid in intellist[technique.technique_id][articleurl]["issues"]:
                        print("* %s (https://github.com/timb-machine/linux-malware/issues/%s), citable: %s" % (articleurl, intelid, intellist[technique.technique_id][articleurl]["citable"]))
                else:
                    for intelid in intellist[technique.technique_id][articleurl]["issues"]:
                        print("* %s (https://github.com/timb-machine/linux-malware/issues/%s), citable: %s (TACTICS OR TECHNIQUES WRONG)" % (articleurl, intelid, intellist[technique.technique_id][articleurl]["citable"]))
            print()
